Key Management Lifecycle Best Practices: 3 Considerations to Be Aware Of
Blog Published: 02/02/2024
Written by the CSA Cloud Key Management Working Group.To implement key management solutions (KMS), it is important to understand the threats and risks facing your organization, as well as its regulatory and compliance needs. With increasing data use and storage risks, organizations must take m...
New Year, New Security Awareness Training—How to Implement a Role-Based Training Program
Blog Published: 02/08/2024
Originally published by BARR Advisory. Written by Larry Kinkaid, Manager, Cybersecurity Consulting, BARR Advisory. As we head into the new year, you might be thinking about your organization’s security and compliance goals. What will you be doing differently? What will remain the same? What d...
Getting a Handle on Your Crypto Assets to Prepare for PQC
Blog Published: 02/12/2024
Originally published by DigiCert. Written by Timothy Hollebeek.Quantum computing’s impending arrival is exposing what cryptography experts already know: Crypto is everywhere. Almost everything that implements modern security practices relies on cryptography and public key infrastructures (PKIs...
Part 1: Non-Human Identity Security – The Complete Technical Guide
Blog Published: 02/02/2024
Originally published by Astrix. Written by Michael Silva, Danielle Guetta, and Tal Skverer. “Identity is the new perimeter.” This catch phrase is present in almost every website of identity security vendors, and for a good reason. Human access, more commonly referred to as user access, is an e...
Part 2: How Attackers Exploit OAuth: A Deep Dive
Blog Published: 02/06/2024
Originally published by Astrix. Written by Michael Silva, Danielle Guetta, and Tal Skverer. “Identity is the new perimeter.” This catch phrase is present in almost every website of identity security vendors, and for a good reason. Human access, more commonly referred to as user access, is an e...
Feeding from the Trust Economy: Social Engineering Fraud
Blog Published: 02/12/2024
Originally published by Microsoft Security. In an increasingly online world, where trust is both a currency and a vulnerability, threat actors seek to manipulate human behavior and take advantage of people’s tendency to want to be helpful. In this infographic, we’ll explore social engineering ...
Ten Important CSPM Best Practices to Follow This Year
Blog Published: 02/07/2024
Originally published by ArmorCode.Cloud Security Posture Management (CSPM) refers to a set of tools and practices to ensure the security and compliance of cloud resources and workloads. CSPM tools help organizations identify and remediate cloud security misconfigurations, monitor compliance wi...
Starting Zero Trust Without Spending a Dime
Blog Published: 02/07/2024
Originally published by CXO REvolutionaries. Written by Brett James, Director, Field Product Management, Zscaler.Changing infrastructure is generally the first draw for any enterprise zero trust initiative, separating resources on the network that traditionally had carte blanche access to anyt...
Life During Wartime: Proactive Cybersecurity is a Humanitarian Imperative
Blog Published: 02/07/2024
Written by: Stan Mierzwa, M.Sc.; CISSP, Head Center for Cybersecurity & Lecturer, Kean University; President CSA NJ Chapter Diane Rubino, M.A.; Adjunct Assistant Professor, School of Professional Studies, New York University; Nonprofit Board Member.In brief:Humanitarian agencies responding...
FedRAMP Baseline Transition Points to OSCAL-Native Tools
Blog Published: 02/13/2024
Originally published by RegScale and MeriTalk. Until recently, FedRAMP (Federal Risk and Authorization Management Program) certification was an Executive Branch mandate, but now that it has become law, it legally stands between cloud service providers (CSPs) and government revenue.Further impa...
DevSecOps: 5 Tips for Developing Better, Safer Apps
Blog Published: 02/13/2024
Blurring the lines of security in application developmentOriginally published by CrowdStrike. According to the CrowdStrike 2023 Global Threat Report, there was a 95% increase in cloud exploits in 2022, with a three-fold increase in cases involving cloud-conscious threat actors. The cloud is ra...
The Return of the Notorious Qakbot Threat Campaign
Blog Published: 02/15/2024
Previous tactics from the dismantled QakBot Trojan now fuel wide-ranging phishing campaignsOriginally published by Skyhigh Security. Written by Rodman Ramezanian, Global Cloud Threat Lead, Skyhigh Security. Remember the QakBot cyberthreat (otherwise known as Qbot or Pinkslipbot)? This threat...
Uncovering Hybrid Cloud Attacks Through Intelligence-Driven Incident Response: Part 3 – The Response
Blog Published: 02/08/2024
Originally published by Gem Security.Written by Yotam Meitar. In the final section of this blog series on uncovering complex hybrid cloud attacks, we’ll share key elements of the response to the real-world sophisticated cloud attack outlined in Part 2. To protect the victim organization’s iden...
The Biggest Cloud Security Threats to Watch Out for in 2024
Blog Published: 02/09/2024
Originally published by Orca Security.Written by Bar Kaduri. It’s hard to believe that 2023 is nearing its end. As we look ahead to 2024, the Orca Research Pod has continued to examine attacker techniques and targets in cloud environments, as well as identify vulnerabilities and weaknesses tha...
Defining 12 CSA Research Topics
Blog Published: 02/09/2024
CSA Research is created by the industry, for the industry. Subject matter experts from a wide array of backgrounds and experiences volunteer for our working groups. Each of these working groups focuses on a unique topic or aspect of cloud security, including AI, IoT, DevSecOps, and much more. ...
Cloud Security Alliance Survey Finds 77% of Respondents Feel Unprepared to Deal with Security Threats
Press Release Published: 02/14/2024
Results highlight the importance of unified visibility across code-to-cloud environments to counter risks effectivelySEATTLE – Feb. 14, 2024 – A new survey and report on The State of Security Remediation from the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defi...
Preparing for the Era of Post-Quantum Cryptography
Blog Published: 02/14/2024
Originally published by HCLTech. Written by Girish Kumar Vaideeswaran, Data Security Consultant, Data Security and Data Privacy, Cybersecurity, HCLTechComputers! What an innovation it has been, incepting from the general-purpose ENIAC, which was approximately housed in a 2000 square foot space...
A CISO Primer for Staying on the Right Side of the SEC’s Cyber Materiality Rules
Blog Published: 02/14/2024
Originally published by CXO REvolutionaries.Written by David Cagigal, Former CIO, State of Wisconsin.When the SEC charged SolarWinds CISO Tim Brown and his employer with fraud and internal control failure that led to the 2020 supply chain cyberattack, CISOs of public companies collectively shu...
Ransomware Unveiled: The Business Impact and Prevention Strategies
Blog Published: 02/13/2024
Originally published by Schellman. In the ever-evolving digital landscape, the sophistication of cybersecurity advances runs in parallel with the advancing cyberattacks. Among these varied threats, ransomware, and what can be its devastating impact, remains a prominent concern as it becomes cl...
CVE-2023-38545: High Severity cURL Vulnerability Detection
Blog Published: 02/20/2024
Originally published by Sysdig on October 12, 2023. Written by Miguel Hernández. On Oct. 11, a new version of curl (8.4.0) was released where a couple of new vulnerabilities were fixed (CVE-2023-38545 with severity HIGH and CVE-2023-38546 with severity LOW). These issues were previously announ...
